2KKUU7ita

278
Part V: Hacking Applications
Choosing Your Web Application Tools
Good web vulnerability scanners and related tools can help ensure that you
get the most from your scans. As with many things in life, I find that you get
what you pay for when it comes to testing for web security holes. This is why
I mostly use commercial tools in my work when testing websites and web
applications for vulnerabilities.
These are my favorite web security testing tools:
✓ Acunetix Web Vulnerability Scanner (www.acunetix.com) for all-inone
security testing, including a port scanner, an HTTP sniffer, and an
automated SQL injection tool
✓ Firefox Web Developer (http://chrispederick.com/work/webdeveloper)
for manual analysis and manipulation of web pages
Yes, you must do manual analysis. You definitely want to use a scanner,
because scanners find around half of the issues. For the other half,
you need to do much more than just run automated scanning tools.
Remember that you have to pick up where scanners leave off to truly
assess the overall security of your websites and applications. You have
to do some manual work not because web vulnerability scanners are
faulty, but because poking and prodding web systems simply require
good old-fashioned hacker trickery and your favorite web browser.
✓ HTTrack Website Copier (www.httrack.com) for mirroring a site for
offline inspection
Mirroring is a method of crawling through (also called spidering) a website’s
every nook and cranny and downloading publicly accessible pages
to your local system.
✓ WebInspect (www.hpenterprisesecurity.com/products/hpfortify-software-security-center/hp-webinspect)
for all-
in-one security testing, including an excellent HTTP proxy and HTTP
editor and an automated SQL injection tool
You can also use general vulnerability scanners, such as QualysGuard and
LanGuard, as well as exploit tools, such as Metasploit, when testing web
servers and applications. You can use these tools to find (and exploit) weaknesses
that you might not otherwise find with standard web-scanning tools
and manual analysis. Google can be beneficial for rooting through web applications
and looking for sensitive information as well. Although these non–
application-specific tools can be beneficial, it’s important to know that they
won’t drill down as deep as the tools I mention in the preceding list.